Consistently use RAND_bytes and check for failure. RAND_pseudo_bytes just calls RAND_bytes now and only returns 0 or 1. Switch all callers within the library call the new one and use the simpler failure check. This fixes a few error checks that no longer work (< 0) and some missing ones. Change-Id: Id51c79deec80075949f73fa1fbd7b76aac5570c6 Reviewed-on: https://boringssl-review.googlesource.com/2621 Reviewed-by: Adam Langley <agl@google.com>
diff --git a/crypto/cipher/e_aes.c b/crypto/cipher/e_aes.c index 64a0ee8..e4d3b8a 100644 --- a/crypto/cipher/e_aes.c +++ b/crypto/cipher/e_aes.c
@@ -448,8 +448,7 @@ if (arg) { memcpy(gctx->iv, ptr, arg); } - if (c->encrypt && - RAND_pseudo_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0) { + if (c->encrypt && !RAND_bytes(gctx->iv + arg, gctx->ivlen - arg)) { return 0; } gctx->iv_gen = 1;